What is CVE-2026-47247?

CVE-2026-47247 is a high-severity vulnerability in Strukturag Libheif, classified under Information Disclosure. CVSS score: 7.5/10. Published 2026-07-21.

How severe is CVE-2026-47247?

High severity. CVSS v3 base score is 7.5 out of 10.

Information disclosure in Strukturag Libheif

CVE-2026-47247

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to…

Vulnerability class: Information Disclosure

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Strukturag Libheif — versions < 1.22.0

Weakness classification (CWE)

CWE-200 — Information Disclosure
CWE-226 — Sensitive Information in Resource Not Removed Before Reuse
CWE-682 — Incorrect Calculation
CWE-908 — Use of Uninitialized Resource

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-47247?: CVE-2026-47247 is a high-severity vulnerability in Strukturag Libheif, classified under Information Disclosure. CVSS score: 7.5/10. Published 2026-07-21.
How severe is CVE-2026-47247?: High severity. CVSS v3 base score is 7.5 out of 10.